Global Vendor List

Here is a technical deep dive into the IAB Global Vendor List (GVL) and the Transparency and Consent Framework (TCF) v2.2/v2.3. Whether you are a publisher looking to optimize your ad stack or a developer managing a Consent Management Platform (CMP), this breakdown covers the infrastructure required for programmatic compliance.

Managing the IAB TCF Global Vendor List (GVL)

Managing the GVL is the operational heartbeat of a publisher’s privacy strategy. Under current GDPR and ePrivacy guidelines, simply “having a banner” isn’t enough. You must actively manage which entities—among the 1,080+ registered vendors—can process user data on your property.

1. The “Whitelisting” Imperative

Publishers often make the mistake of including the entire GVL in their CMP. This is a compliance risk. Regulators (such as the Belgian DPA) have clarified that users must be able to comprehend who is processing their data.

• Pruning the List: Only enable vendors you have a contractual relationship with (SSPs, DSPs, Analytics).

• Frequency: The IAB updates the GVL weekly. Your CMP must sync with these updates to ensure no “Ghost Vendors” (deprecated IDs) remain in your string.

2. Publisher Restrictions

The TCF allows you to exert granular control over how vendors process data. You can:

• Restrict Purposes: Allow a vendor to use data for “Ad Selection” but block them from “Profiling.”

• Legal Basis Overrides: Force a vendor to rely on Consent even if they have declared Legitimate Interest as their default in the GVL.

What is a Vendor in IAB?

In the IAB ecosystem, a Vendor is any third-party company that does not have a direct relationship with the end-user but requires data to perform a function in the advertising supply chain.

TCF Vendors Meaning

A “TCF Vendor” is a company that has undergone the IAB Europe registration process. By joining the GVL, they commit to:

1. Parsing the TC String: They must be able to read the digital consent signal generated by your CMP.

2. Respecting Signals: If the string says “No Consent,” the vendor must legally and technically cease data processing.

3. Standardized Disclosure: They must provide a standard URL to their privacy policy and declare their data retention periods.

Technical Architecture: IAB Global Vendor List JSON

The GVL is delivered as a machine-readable JSON file. This file is the “dictionary” that your CMP uses to build the user interface.

IAB TCF Vendor List JSON (Current Version)

As of the most recent update, the industry is transitioning from v2.2 to v2.3. The JSON schema has become more rigorous to satisfy “Transparency” requirements.

Key JSON Fields to Monitor:

• purposes: Definitions for the 11 standard purposes (e.g., Purpose 1: Store/access information on a device).

• specialPurposes: Functions like “Ensuring security” which usually don’t require an opt-out.

• dataDeclaration: A new requirement in recent versions that forces vendors to list exactly what data categories (IP address, device ID, etc.) they collect.

Global Vendor List JSON Snippet

{
  "gvlSpecificationVersion": 3,
  "vendorListVersion": 192,
  "tcfPolicyVersion": 4,
  "lastUpdated": "2025-01-20T10:00:00Z",
  "vendors": {
    "755": {
      "id": 755,
      "name": "Google Advertising Products",
      "purposes": [1, 3, 4],
      "legIntPurposes": [2, 7, 9, 10],
      "flexiblePurposes": [2, 7, 9, 10],
      "specialPurposes": [1, 2],
      "features": [1, 2],
      "specialFeatures": [],
      "policyUrl": "https://policies.google.com/privacy"
    }
  }
}

Google Vendor List vs. IAB GVL

It is critical to distinguish between the IAB GVL and the Google Ad Tech Provider (ATP) List.

• IAB GVL: A cross-industry list for any vendor using the TCF.

• Google ATP: A proprietary list of vendors Google allows to serve ads within Google Ad Manager/AdSense.

• Integration: If a vendor is on the Google ATP list but not the IAB GVL, your CMP must use Google’s “Additional Consent” (AC) String to pass consent to them.

Technical Audit Checklist: CMP vs. GVL

Use this checklist to ensure your CMP configuration isn’t leaking data or violating TCF policies.

• [ ] TCF v2.3 Ready: Does your CMP support the mandatory “Disclosed Vendors” segment (required by Feb 2026)?

• [ ] Vendor Count Disclosure: Does your first-layer UI explicitly state the total number of vendors (e.g., “We work with 42 partners”)?

• [ ] Auto-Sync Check: Is your CMP fetching the latest GVL JSON weekly, or are you running on a cached version from months ago?

• [ ] Legitimate Interest Audit: Have you disabled Legitimate Interest for Purposes 3, 4, 5, and 6? (This is now a TCF requirement).

• [ ] Device Storage Disclosure: Verify that vendors claiming Purpose 1 have a valid deviceStorageDisclosureUrl in the JSON.

• [ ] Negative Signal Testing: Use a TCF Debugger (like the IAB Chrome Extension) to verify that when a user clicks “Reject All,” the TC String actually encodes a “0” for all vendor IDs.

List of Major IAB TCF Vendors (Top IDs)

While the full list exceeds 1,000 entries, these are the primary vendors that drive the majority of global programmatic revenue.

The Full Global Vendor List from the IAB in One Central Place

Note: For the full, real-time list of 1,080+ vendors, you can also reference the official IAB Europe Live Vendor List or I have the entire list pasted below and we’d like to let anybody looking for Consent Platforms that the Captain Compliance consent banner is 1 of only 2 consent platforms that validate and pass all tests.